Query

ThreatIntelligenceIndicator
| where TimeGenerated > ago(30d)
| extend IOC = iff(isnotempty(DomainName), DomainName, 
iff(isnotempty(NetworkIP), NetworkIP, iff(isnotempty(Url), Url, "No IOC defined")))
| summarize count() by bin(TimeGenerated, 1d), IOC
| render columnchart with (kind=stacked, title="Threat Intelligence Indicators triggered each day")

About this query

Visualize the Threat Intelligence Indicators by day for the last 30 days

Query Information

Description

This query visualizes the amount of IOCs that have triggerd each day for the last 30 days in a timechart. This could indicate spikes in malicious activities by users or give intsights in the value of Threat Intelligence feeds.

Sentinel

Explanation

This query is designed to visualize the number of threat intelligence indicators (IOCs) that have been triggered each day over the past 30 days. Here's a simple breakdown of what the query does:

Data Source: It starts by accessing the ThreatIntelligenceIndicator table, which contains information about various threat indicators.
Time Filter: It filters the data to include only those entries that were generated in the last 30 days.
IOC Identification: For each entry, it checks if there is a domain name, network IP, or URL associated with it. It uses these to define the IOC (Indicator of Compromise). If none of these are present, it labels it as "No IOC defined".
Data Aggregation: It groups the data by each day (using bin(TimeGenerated, 1d)) and counts the number of IOCs for each day.
Visualization: Finally, it creates a stacked column chart to visually represent the number of IOCs triggered each day, with the title "Threat Intelligence Indicators triggered each day".

This visualization helps in identifying any spikes in malicious activities and assessing the effectiveness of threat intelligence feeds over the past month.

KQL Search